# 构建阶段
FROM python:3.11-slim AS builder

# 设置环境变量以优化构建过程
ENV PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    NPM_CONFIG_REGISTRY=https://registry.npmmirror.com \
    DEBIAN_FRONTEND=noninteractive

# 设置工作目录
WORKDIR /app

# 配置镜像源并安装构建依赖
RUN if [ ! -f /etc/apt/sources.list ]; then \
        echo "deb https://mirrors.tuna.tsinghua.edu.cn/debian bookworm main non-free contrib" > /etc/apt/sources.list; \
    else \
        sed -i 's/deb.debian.org/mirrors.tuna.tsinghua.edu.cn/g' /etc/apt/sources.list; \
    fi && \
    echo "deb https://mirrors.tuna.tsinghua.edu.cn/debian-security bookworm-security main" >> /etc/apt/sources.list && \
    apt-get update -qq && \
    apt-get install -y --no-install-recommends \
        gcc \
        curl \
        xz-utils && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# 手动安装 Node.js 和 npm
RUN curl -fsSL https://nodejs.org/dist/v18.19.0/node-v18.19.0-linux-x64.tar.xz | tar -xJ -C /usr/local --strip-components=1 && \
    node -v && \
    npm -v

# 升级 pip 并配置清华源
RUN pip install --upgrade pip -i https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn && \
    pip config set global.index-url https://pypi.tuna.tsinghua.edu.cn/simple

# 创建 appuser 并设置权限
RUN useradd -m -s /bin/bash appuser && \
    chown appuser:appuser /app && \
    chmod -R u+w /app

USER appuser
ENV PATH=/home/appuser/.local/bin:$PATH

# 复制依赖文件
COPY requirements.txt package.json ./

# 安装 Python 和 Node.js 依赖
RUN pip install --no-cache-dir --user -r requirements.txt gunicorn -i https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn && \
    npm install

# 运行阶段
FROM python:3.11-slim

# 设置环境变量
ENV PYTHONUNBUFFERED=1 \
    PATH=/home/appuser/.local/bin:/usr/local/bin:$PATH \
    DEBIAN_FRONTEND=noninteractive

# 设置工作目录
WORKDIR /app

# 安装运行时依赖
RUN if [ ! -f /etc/apt/sources.list ]; then \
        echo "deb https://mirrors.tuna.tsinghua.edu.cn/debian bookworm main non-free contrib" > /etc/apt/sources.list; \
    else \
        sed -i 's/deb.debian.org/mirrors.tuna.tsinghua.edu.cn/g' /etc/apt/sources.list; \
    fi && \
    echo "deb https://mirrors.tuna.tsinghua.edu.cn/debian-security bookworm-security main" >> /etc/apt/sources.list && \
    apt-get update -qq && \
    apt-get install -y --no-install-recommends \
        curl && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# 创建 appuser
RUN useradd -m -s /bin/bash appuser && \
    mkdir -p /home/appuser/.local && \
    chown appuser:appuser /home/appuser/.local

# 从构建阶段复制依赖
COPY --from=builder /home/appuser/.local /home/appuser/.local
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /usr/local/bin/node /usr/local/bin/node
COPY --from=builder /usr/local/bin/npm /usr/local/bin/npm
COPY --from=builder /usr/local/lib/node_modules /usr/local/lib/node_modules

# 复制项目文件
COPY . .

# 设置权限
RUN chown -R appuser:appuser /app && \
    mkdir -p /app/downloads && \
    chmod -R 755 /app/downloads

# 切换到非 root 用户
USER appuser

# 暴露端口
EXPOSE 9091

# 健康检查
HEALTHCHECK --interval=30s --timeout=10s --retries=3 --start-period=10s \
    CMD curl -f http://localhost:9091/health || exit 1

# 启动命令
CMD ["gunicorn", "main:app", "--workers", "4", "--worker-class", "uvicorn.workers.UvicornWorker", "--bind", "0.0.0.0:9091"]